From 2bec615f5c58bc8e7ecffdb6feabcd7cd10b059b Mon Sep 17 00:00:00 2001 From: Shimana P Date: Fri, 19 Jul 2024 14:40:57 +0530 Subject: [PATCH 1/2] asoc: msm-lsm-client: check for param size before copying check for the proper param size before copying, to avoid buffer overflow. Change-Id: I3e41439fb747aeebe7677b32c768aea19fcea37c Signed-off-by: Shimana P --- asoc/msm-lsm-client.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/asoc/msm-lsm-client.c b/asoc/msm-lsm-client.c index 9b82d8c49a51..bd9b73571263 100644 --- a/asoc/msm-lsm-client.c +++ b/asoc/msm-lsm-client.c @@ -830,6 +830,13 @@ static int msm_lsm_reg_model(struct snd_pcm_substream *substream, q6lsm_sm_set_param_data(client, p_info, &offset, sm); + if ((sm->size - offset) < p_info->param_size) { + dev_err(rtd->dev, "%s: user buff size is greater than expected\n", + __func__); + rc = -EINVAL; + goto err_copy; + } + /* * For set_param, advance the sound model data with the * number of bytes required by param_data. From a7a80492158fd8d42e79591828086eb8d79f02ee Mon Sep 17 00:00:00 2001 From: Shimana P Date: Wed, 24 Jul 2024 12:55:49 +0530 Subject: [PATCH 2/2] dsp: q6voice: Add buf size check for cvp cal data Check for the max size of cvp command register calibration data that can be copied to avoid buffer overflow. Change-Id: I41793bef75095ef06d7dda171bd2eba158422cc9 Signed-off-by: Shimana P --- dsp/q6voice.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/dsp/q6voice.c b/dsp/q6voice.c index 23bc780a6932..03e27b3978a2 100644 --- a/dsp/q6voice.c +++ b/dsp/q6voice.c @@ -3322,6 +3322,13 @@ static int voice_send_cvp_register_cal_cmd(struct voice_data *v) voc_get_session_name(v->session_id), v->dev_tx.dev_id, v->dev_rx.dev_id); + if (col_data->cal_data.size >= MAX_COL_INFO_SIZE) { + pr_err("%s: Invalid cal data size %d!\n", + __func__, col_data->cal_data.size); + ret = -EINVAL; + goto unlock; + } + memcpy(&cvp_reg_cal_cmd.cvp_cal_data.column_info[0], (void *) &((struct audio_cal_info_voc_col *) col_data->cal_info)->data, @@ -3519,6 +3526,13 @@ static int voice_send_cvp_register_vol_cal_cmd(struct voice_data *v) goto unlock; } + if (col_data->cal_data.size >= MAX_COL_INFO_SIZE) { + pr_err("%s: Invalid cal data size %d!\n", + __func__, col_data->cal_data.size); + ret = -EINVAL; + goto unlock; + } + memcpy(&cvp_reg_vol_cal_cmd.cvp_vol_cal_data.column_info[0], (void *) &((struct audio_cal_info_voc_col *) col_data->cal_info)->data,